Improve Sanitizing

ekntrtmz · Sep 23, 2020 · 5fe5995 · 5fe5995
1 parent 3d13936
commit 5fe5995
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 5 deletions.
diff --git a/admin/class-wp-dispatcher-add-new-upload.php b/admin/class-wp-dispatcher-add-new-upload.php
@@ -102,9 +102,9 @@ public function wp_dispatcher_process_upload(){
 		else {
 			if(isset($_FILES['file_upload'])){
 
-				$source = $_FILES['file_upload']['tmp_name'];
+				$source = sanitize_file_name($_FILES['file_upload']['tmp_name']);
 
-				$filename = $_FILES['file_upload']['name'];
+				$filename = sanitize_file_name($_FILES['file_upload']['name']);
 
         //$ext = pathinfo($_FILES['file_upload']['name'], PATHINFO_EXTENSION);
         //$uuid = uniqid();

diff --git a/admin/class-wp-dispatcher-settings.php b/admin/class-wp-dispatcher-settings.php
@@ -84,7 +84,8 @@ public function render_settings_page_content( $active_tab = '' ) {
 			<?php 
 
 				if( isset( $_GET[ 'tab' ] ) ) {
-				$active_tab = $_GET[ 'tab' ];
+
+				$active_tab = sanitize_text_field($_GET[ 'tab' ]);
 			} else if( $active_tab == 'uploads' ) {
 				$active_tab = 'uploads';
 			} else if( $active_tab == 'links' ) {
@@ -112,7 +113,7 @@ public function render_settings_page_content( $active_tab = '' ) {
 				<!-- Forms are NOT created automatically, so you need to wrap the table in one to use features like bulk actions -->
 				<form id="movies-filter" method="get">
 				<!-- For plugins, we also need to ensure that the form posts back to our current page -->
-					<input type="hidden" name="page" value="<?php echo $_REQUEST['page'] ?>" />
+					<input type="hidden" name="page" value="<?php echo esc_attr($_REQUEST['page']) ?>" />
 					<?php $uploads_list_table->display();	?>
 				</form>
 
@@ -127,7 +128,7 @@ public function render_settings_page_content( $active_tab = '' ) {
 				<!-- Forms are NOT created automatically, so you need to wrap the table in one to use features like bulk actions -->
 				<form id="movies-filter" method="get">
 					<!-- For plugins, we also need to ensure that the form posts back to our current page -->
-					<input type="hidden" name="page" value="<?php echo $_REQUEST['page'] ?>" />
+					<input type="hidden" name="page" value="<?php echo esc_attr($_REQUEST['page']) ?>" />
 					<?php $links_list_table->display();	?>
 				</form>